WebTic security guide
The security of your account is a priority. This guide presents best practices to protect your telephone services and your data.
1. Two-factor authentication (2FA)
Be sure to enable 2FA on your WebTic account:
- Go to Account → Security → Two-Factor Authentication
- Scan the QR code with Google Authenticator, Authy or 1Password
- Save the recovery codes in a safe place
2FA blocks the vast majority of unauthorised login attempts, even if your password is compromised.
2. Strong password
- Minimum 12 characters with uppercase, lowercase, digits and symbols
- Unique — never use the same password on multiple sites
- Use a password manager (Bitwarden, 1Password, KeePass)
- Change your password every 12 months, or immediately if you suspect a compromise
3. Securing your SIP trunk
SIP trunks are frequent targets for telephony fraud. Essential measures:
- IP Whitelist: in your client area, restrict SIP access to your public IPs. Go to Services → Your trunk → Security → Allowed IPs
- Call cap: set a maximum daily/monthly budget to block abuse
- Fraud alerts: enable email notifications for calls to unusual premium destinations
- Strong SIP password: use the generator in your client area to obtain a random password of 20+ characters
4. Monitoring and alerts
- Regularly review your account's Activity Logs
- Enable email alerts for every login from a new IP
- Check the CDR (Call Detail Records) weekly to detect abnormal calls
5. 3CX security
If you use 3CX:
- Keep 3CX up to date — updates fix critical security vulnerabilities
- Disable admin access from the Internet (use a VPN)
- Change the default ports (5060, 5001)
- Enable the built-in 3CX firewall with brute-force attack detection
If you suspect a compromise
If you suspect fraudulent activity:
- Immediately change your password and SIP password
- Temporarily disable your trunk from the client area
- Open an urgent ticket with WebTic support
- Review the CDRs to identify suspicious calls
